Static task
static1
Behavioral task
behavioral1
Sample
681c7b5f216f25699c89146cc92db410_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
681c7b5f216f25699c89146cc92db410_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
681c7b5f216f25699c89146cc92db410_JaffaCakes118
-
Size
15KB
-
MD5
681c7b5f216f25699c89146cc92db410
-
SHA1
0b46cad908cb28cd88d9fb0ef3d975572a32e7f5
-
SHA256
29c2a103db7cff2990cdb0867021a51c606c30586319081b3ecddcb905428c7a
-
SHA512
df956672b8a897ee8f01417f1f190ee171fa95764f0c0ae22ae052c0744af42b5a76dde2e5fe2fa3bef09f8c9c84aac2c3cde2cef615cf42c0e3e169aa440a0c
-
SSDEEP
384:yuHyu4inIibeo6QqGHpuDlbmLDRGdYpZauvWF:yuHNbnh6QqGJf8n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 681c7b5f216f25699c89146cc92db410_JaffaCakes118
Files
-
681c7b5f216f25699c89146cc92db410_JaffaCakes118.exe windows:5 windows x86 arch:x86
f72ff01330ee599835f95af3d4365e9d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
exit
advapi32
CopySid
user32
SetTimer
netapi32
NetUserGetInfo
psapi
EnumProcesses
ole32
CoInitialize
wtsapi32
WTSRegisterSessionNotification
rpcrt4
NdrClientCall2
Sections
.MPRESS1 Size: 11KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE